Analysis
-
max time kernel
149s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12/10/2024, 04:55
General
-
Target
2024-10-12_aed15c0f5fc4594aa2ce31f4972588f1_goldeneye.exe
-
Size
344KB
-
MD5
aed15c0f5fc4594aa2ce31f4972588f1
-
SHA1
c5059499eaee881b2c5b2230669e729d9a918c3b
-
SHA256
ffc7cd854d3f5997e58d485f5f2e77b9e522f51226143f53fecaea43b893f6e1
-
SHA512
7385f44dcb3c472314fecb8023a114e6299a641e92ddf059d831a68b99990eed97445c86e655dfdc3eb7ca354059b40c2180c614a7b01577465c477126968432
-
SSDEEP
3072:mEGh0oZyqlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEF:mEG3yqlqOe2MUVg3v2IneKcAEcA
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-12_aed15c0f5fc4594aa2ce31f4972588f1_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-12_aed15c0f5fc4594aa2ce31f4972588f1_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EB7B593B-8928-40c6-9B53-5539B1C28A1B}.exeC:\Windows\{EB7B593B-8928-40c6-9B53-5539B1C28A1B}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D620CF8D-2144-4bc3-AE28-8371B2FE13C2}.exeC:\Windows\{D620CF8D-2144-4bc3-AE28-8371B2FE13C2}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{94FC55A8-294D-40c2-A5C1-AD1D36B30ABD}.exeC:\Windows\{94FC55A8-294D-40c2-A5C1-AD1D36B30ABD}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C0291EF7-D268-4c34-AC4E-203C0D3C31EF}.exeC:\Windows\{C0291EF7-D268-4c34-AC4E-203C0D3C31EF}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5CB24C4D-AA13-4630-9486-A9C5D9D97813}.exeC:\Windows\{5CB24C4D-AA13-4630-9486-A9C5D9D97813}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9BE55068-AB1E-4dae-9B6B-DAAF95FDE7E1}.exeC:\Windows\{9BE55068-AB1E-4dae-9B6B-DAAF95FDE7E1}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{57E24E73-6AF5-4aa2-A58C-D1ED4B118079}.exeC:\Windows\{57E24E73-6AF5-4aa2-A58C-D1ED4B118079}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CFE17162-84E6-4d59-AAA8-BC2E922B9BDD}.exeC:\Windows\{CFE17162-84E6-4d59-AAA8-BC2E922B9BDD}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8B0666D7-8DA1-477b-882B-C56541910117}.exeC:\Windows\{8B0666D7-8DA1-477b-882B-C56541910117}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5BE5D593-3CC9-4b1e-96B0-C622C00B5891}.exeC:\Windows\{5BE5D593-3CC9-4b1e-96B0-C622C00B5891}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{58AEE73B-07DD-467d-BAA1-AB1C23C27DC9}.exeC:\Windows\{58AEE73B-07DD-467d-BAA1-AB1C23C27DC9}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{34ABA4B6-381C-4a51-BA81-5B3833967644}.exeC:\Windows\{34ABA4B6-381C-4a51-BA81-5B3833967644}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{58AEE~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5BE5D~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8B066~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CFE17~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{57E24~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9BE55~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5CB24~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C0291~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{94FC5~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D620C~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EB7B5~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
344KB
MD52e9266c1dc31a4c78bfa598269075a1d
SHA14f843f29874e992b7f5ef76604ddd1efefb556ae
SHA25652449c2058f0ceebdc842b59af612424695dec4e60b424dfd40644c42c356f5b
SHA5124acc60219fa8f67c4117a2e77c9f2091a182051be4cb5da34edabb5d9c3020ccb6b424868bd31175d3281f22390e2d5211e3b6900b9870cfb2e59a476de91fd5
-
Filesize
344KB
MD5de3288d61576a62c23c42a5e7b5e54c9
SHA186c978840f0f2f7f7fba81a07bc09c6cb30fc234
SHA256503cd356a11c53d4c43ebe37578cdcb83cba09d72951a2e80f64efeca36a402e
SHA512392bb43ba2d6bce37dba3fa0eabd5309e53ec8ca2abc06626a3021c57405d780475fc8a5b9d31090efba8cbec7d06e60be04dbbe2856d312bdd7e0ecded01b1e
-
Filesize
344KB
MD5bdbc347c4180dcf1962e7bfbd388e4fb
SHA16d7b8661ae06ec288f4305b4ef1e7defa633db86
SHA25637c3f59d61965e5728b3e9529e5cee6cb45fcec785bc300d33b8d5c9f09c45f5
SHA512bdb5dd5ee5a3450afac9a38df6fb5cd33d1cf8684ae0de7a1efe5528b0dc98cd7c2e3fbabdbe83bfbd69ba7a9863cf4154a4489d0a7daaef001dffd3cd45a5ba
-
Filesize
344KB
MD5a77a77b01a179f5539ad66b95a7a0d57
SHA147c5a5d49558a3224a7b9c13eda0ec11d7bdb692
SHA2560b619cfed32bd0847282a8a25024165a50aa410293c0f6a4972a0ad0d6f477da
SHA5122b1b6dcb35098b4213efe93fba17e4c9789a197c5d9948bdf444edc550dbad83dd48c3a81cc9656fd4544c4bfa1093a88a72d2b03357c9aecce93d8abf0a4c8e
-
Filesize
344KB
MD5bd979dfeeafa8480e228e595e7e8722f
SHA1091eb10b6fa3f005d3f66946315b9bc259a52f9a
SHA256abceb9182fefd76fd7306f9136583c7cb655df7de3feacf3dd0d48246ea3441b
SHA512a653d0bbfd0fe8630d30a0609fd908164be2758a883a38632d71f1de1068363cce0f0b6cfadfda69026ec6fc19f2952c925ba84d7adeb6ae8ac95a21c2886bc2
-
Filesize
344KB
MD5f336a34711bc6ceeca30c892e1ed745e
SHA14e1d0d90985e61afae1b45b09c097f4dc4edd2f3
SHA256f9818b6bef692c1b9ea704ec0efbd4fc47620f8771fb0a6cc3c1f498852d04a2
SHA51216eb916f56c3577079da362f7df1af602521095772acc70af4de6f1744867aaeffb3d97cb42820f6f3c2286cf63f97c3738779e1a2dc96af4a8ef2c8d01b7d04
-
Filesize
344KB
MD5fd5672ed18ede7b5bf782f775d57c516
SHA156068fceb13bd445982458d3e1c50e1cddb132ed
SHA25667f79c4a79301cd2ca87553617a4b7814f8bd533be4b445e5bba8091b80dcb48
SHA512717e13e01b6adcd1547bf0fb6f660890ced5131f0f225d08a26f460352b11c7411b94e6e2e7cbadbe1cbd97f8f8a446441027a1f889cf79f08693dbe2dbbd526
-
Filesize
344KB
MD5b7f5e0f0e8680f8be37b901fcb6c3891
SHA1ec7fa9c39dfcc7c38037adc9e6b25886f735be4c
SHA2567466415b9391eea5a756f6a22b16ccce001411f6887db7a524bce5d66ee0761c
SHA5120c8ef60d2da298257731f91be2a8c929f12b571e2a918565b8e06574bcebb0c51bc50b66291a98c415ccac70fd77333dee70e0eef54381300ac2b407a3dd0b40
-
Filesize
344KB
MD5b9f68913677705f57277be73df39ecab
SHA1ab3490abfb3175dd721af323378aa19b158f8175
SHA256d6320f029e541d1c6aa03b204cb521c793f9a245251ba89fb4a73d2d29475f5f
SHA51217a5566746905c0ad0e482aaac8b0ab67650c8e886b324c739bf864d6bad8a46248bee35a6f2fab3906839d639671fc3d5589013af14a2343880e5d064d5a260
-
Filesize
344KB
MD5d2a9f365578cf2b7e38c60f4f5ac9485
SHA1958cb81f0fbf05b0e92dbdb86ec4933e8f8362a6
SHA256c8f97f44bf5fe092b1d2da768f8f14734704f7018ba6cf36e832321aec625ac8
SHA512e61a2d7a9f1a11d045adcf3ca12e381a49a6d981b5a7564a7646f3bf6ad5566f52aedaa095e1d87ca7d023cb3bd130e48dbe0c06fafe73aafee39fd784a6c7a3
-
Filesize
344KB
MD5099b96ae4dace0992bb198270e3ecff9
SHA1a6c99e522a459ba9e611dda0103b5bf49975a039
SHA256cf008f2cdaf8f84af18dd67f80fc75f8ebc4b7ffe881582f3f54b2b8cfcec0b7
SHA5121d6dc17b0327b596ff7579ad231d4eaff873b23ebd8f6c3e5c070b1beebf586743fdbdec06d3d6dc5a07a4e9393bf239c9ce1022fc56dd42fe19485e7d046ca5
-
Filesize
344KB
MD50694b8c2338c61cbdde07d3d165e78de
SHA1c84c02e3e7ddaeac51a216551fad932b1724c835
SHA25664f4a7c89c5efd9e4a6187b7e9bbd6f0ab2427b430c9d338cc32b0ddfcab5b52
SHA5123ad8e6e57e10e9881c93afc1a457b03852a3fbf1a5f262fb3f6d339d561c67bf0092bd5193609e0785b271e2add758c28d4688d15816ef2b139fefad2b5f78a3